CVE-2022-35918mediumCWE-22

CVE-2022-35918: falha de média gravidade em streamlit

Streamlit directory traversal vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar streamlit+ Monitorar streamlit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.8%
Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
streamlit · streamlit
CVEs relacionadas — streamlit

No mesmo produto, das mais perigosas para as menos.

CVE-2024-42474MEDIUMStreamlit Path Traversal Security Vulnerability on WindowsEPSS 0.6%CVE-2023-27494MEDIUMStreamlit Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2026-33682MEDIUMStreamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure)EPSS 0.3%